Articles Tagged “Security”
36 articles tagged “Security”, newest first.
-
The Depths of Windows Virtualization (Part 2) — Memory Even the Kernel Cannot See: How VBS, HVCI, and Credential Guard Work
On a clean install to compatible hardware, VBS is enabled by default and uses the hypervisor and SLAT to create isolation stronger than the kernel. This arti...
-
Named Pipes in Practice — Windows' Standard IPC from Design to Security
A practical guide to named pipes, Windows' standard inter-process communication. This article organises, from primary sources, the choice between byte and me...
-
Choosing a Windows Service Account — LocalSystem, Virtual Accounts, and gMSA
Are you still running a Windows service as LocalSystem? This article compares the privileges and network identity of LocalService, NetworkService, virtual ac...
-
Windows Security Audit Policy and Event Log Investigation in Practice — Becoming an IT Team That Can Read Event 4625
A practical guide for answering "please look into the failed sign-in logs." It covers the relationship between basic and advanced audit policy, the subcatego...
-
A Practical Guide to Windows LAPS — Retiring the Shared Local Administrator Password Across All PCs
A shared local administrator password across every PC is fertile ground for Pass-the-Hash attacks, where the compromise of one machine spreads to all of them...
-
The Windows Certificate Store in Practice — User or Computer, Which Should You Use?
Should a client certificate go in the user store or the computer store? This practical guide works systematically through the classic certificate mistakes — ...
-
The Windows Firewall and Business Applications — Register Inbound Rules From the Installer
"It works on the dev machine but the client can't connect" almost always traces back to the Windows Firewall. This article covers the default-block-inbound b...
-
Windows Update Management After WSUS Deprecation — How to Choose Between WUfB, Autopatch, and Intune
Microsoft announced the deprecation of WSUS in September 2024. It is not stopping immediately, but new feature development has ended. This article lays out f...
-
BitLocker Practical Guide — Drive Encryption Starting With Recovery Key Management
From Windows 11 24H2 onward, clean installs enable device encryption by default, and "suddenly finding out it's encrypted" incidents are now happening in pra...
-
Why Are Passkeys Secure? — An Illustrated Guide to Authentication That Never Sends a Secret
An illustrated explanation of why passkeys are secure: the public-key cryptography that keeps the private key off the server and off the wire, why phishing c...
-
The Depths of Windows I/O (Part 6, Final) — Filter Drivers and Minifilters: Why Procmon and Antivirus Scanners Can Intercept I/O
The final instalment of a series illustrating Windows filter drivers and minifilters. It covers the Filter Manager and altitudes, pre/post callbacks, how Pro...
-
AppLocker, App Control for Business (WDAC), and Business App Distribution — Before "Application Control" Blocks You
Explains the differences between AppLocker, App Control for Business (formerly WDAC), and Smart App Control, and sets out what developers and distributors ca...
-
SMB Signing and LDAP Channel Binding — Closing the "Other Half" of Your NTLM Defences in Practice
SMB signing and LDAP signing/channel binding are the defences that limit the damage from relay attacks while you work towards retiring NTLM. This article lay...
-
NTLM and Kerberos Explained with Diagrams — Why Authentication Falls Back to NTLM
An illustrated comparison of NTLM and Kerberos: challenge/response, TGTs and service tickets, the conditions under which Negotiate falls back to NTLM when an...
-
Will NTLM Deprecation Stop Your Business Apps? — How to Collect Audit Logs, and the Order in Which to Kill Dependencies
A practical procedure for finding out where your Windows environment and business applications depend on NTLM ahead of its retirement: audit policies, follow...
-
What Is the TPM in Windows? — An Illustrated Guide to the "Safe That Never Lets Keys Out" and Measured Boot
An illustrated explanation of the TPM: how keys never leave the chip, PCRs and Measured Boot, how BitLocker and Windows Hello use it, the differences between...
-
Hardening PowerShell — Logging, AMSI, Language Modes, and JEA
A practical guide to using PowerShell safely instead of banning it. Covers enabling script block logging and transcription, AMSI and disabling the old engine...
-
An Introduction to Microsoft Graph PowerShell — Running Microsoft 365 After the Retirement of AzureAD and MSOnline
A practical guide to migrating Microsoft 365 operations to Microsoft Graph PowerShell now that the AzureAD and MSOnline modules have been retired: connecting...
-
Handling Credentials Safely in PowerShell — Banishing Plaintext Passwords from Your Scripts
A practical walkthrough of moving plaintext passwords out of PowerShell scripts and into safe storage: what SecureString really is and where it stops, how Ex...
-
Taking Inventory of a File Server with PowerShell — Capacity Analysis and Access Permission (ACL) Auditing
A practical procedure for taking inventory of a file server with PowerShell. Covers capacity analysis and recording access denials, listing old files and ext...
-
An Introduction to PowerShell Remoting (WinRM) — Managing Multiple Windows Machines at Once
An introduction to managing multiple Windows machines at once with PowerShell Remoting (WinRM). Covers how it works and ports 5985/5986, what Enable-PSRemoti...
-
PowerShell Execution Policy and Script Signing — A Practical Guide to Graduating From "Papering Over It With Bypass"
PowerShell's execution policy is "a safety feature, not a security boundary." This article covers the differences between policies like RemoteSigned, scope p...
-
When Your In-House Windows App Gets Flagged as a Virus — Handling Microsoft Defender False Positives and Living With the Performance Impact
We lay out the proper way to respond when Microsoft Defender flags your in-house Windows app as malware: how modern antivirus detection actually works, how t...
-
Integrating Entra ID Authentication into WinForms/WPF Apps — A Practical Architecture with MSAL.NET and the WAM Broker
A practical, hands-on look at integrating Entra ID (formerly Azure AD) authentication into WinForms/WPF desktop apps: the public client mindset, where ROPC s...
-
What to Do Before Disposing of a Windows PC — A Practical Checklist for Data Erasure, Account Unlinking, and Backups
What to do before disposing of, transferring, selling, or returning a leased Windows PC — covering backups, data erasure, BitLocker, Microsoft accounts, OneD...
-
Handling Windows Impersonation Tokens Correctly — Borrowing Privileges per Thread and Reverting Safely
A practical guide to Windows impersonation tokens — access tokens, primary tokens, thread tokens, impersonation levels, RevertToSelf, and .NET's WindowsIdent...
-
Why Windows Became What It Is Today: The Evolution of Windows Through a Developer's Eyes
A look at the changes from Windows 95 to Windows 11 — not as a visual timeline, but from a Windows application developer's perspective: compatibility, stabil...
-
Why Windows Shows "Windows protected your PC"
Why your app triggers "Windows protected your PC": SmartScreen checks publisher reputation, not just signatures. Compare OV/EV certs, MSIX, and the Store.
-
Pseudo-Random vs. True Random Numbers - How Do You Actually Tell Them Apart?
Pseudo-random (PRNG) vs true random (TRNG): PRNGs are deterministic and seeded; TRNGs harvest physical entropy. How to tell them apart and when each fits.
-
Security Design for Auto-Update - Why HTTPS Alone Is Not Enough
We treat auto-update as a trust boundary and walk through signed metadata, client-side verification, key separation, rollback protection, and fail-closed des...
-
A Practical Procedure for Identifying the Scheme Behind a Hash String
When identifying the scheme behind a hash string left in logs or a DB, it helps to look at the prefix, separators, character set, and length, in that order. ...
-
How Windows DLL Name Resolution Works - Search Order and SxS
Where does LoadLibrary actually look? Walk through the Windows DLL search order, Known DLLs, API sets, and SxS manifests, and how to prevent DLL hijacking.
-
When Do You Actually Need Administrator Privileges on Windows? - UAC, Protected Areas, and How to Tell by Design
A practical look at when administrator privileges are required on Windows, from the perspectives of UAC, protected areas, services, drivers, and per-user/per...
-
How to Concretely Isolate "Only the Operations That Need Administrator Privileges" in a Windows App
A concrete walkthrough of keeping a Windows app UI at asInvoker while isolating only the administrator-privileged operations into a helper EXE, covering UAC,...
-
Storing Secrets in Windows Apps - Avoiding Plaintext Configuration with DPAPI
To avoid storing connection credentials and API tokens in plaintext configuration files in Windows apps, we walk through DPAPI / ProtectedData, the differenc...
-
A Minimum Security Checklist for Windows App Development
A checklist-style guide to the security basics for WPF / WinForms / WinUI / C++ / C# business apps: privileges, signing, updates, secrets, HTTPS, input valid...